3 ms·
As username is public, it provides no security. So 1 account password with likely low entropy has been replaced with application-specific high-entropy passwords
by dtech 7y ago
As username is public, it provides no security. So 1 account password with likely low entropy has been replaced with application-specific high-entropy passwords. This is an improvement.
- Nextgrid 7y agoWouldn’t the low-entropy password still work on the web interface, and if so why is it an improvement? Any brute force attempts can very well be done on the web interface, and if there are countermeasures why can’t they be used on the API endpoints?
- nullandvoid 7y agoIsn't the idea you would have 2 factor auth on your account preventing any web brute force. Then generate API keys on a per project reducing the attack surface in the case of breach?
- Nextgrid 7y agoYes that’s correct, but if you choose to not use 2FA for whatever reason I don’t see why password auth shouldn’t be supported on the API instead of making you waste time generating an API key that won’t actually improve security in any way (since attackers can brute force the account anyway).